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REMARKS/ARGUMENTS 

Prior to this Amendment, Claims 1-4, 6-10, 12-15, 17-36, 38-59, and 61-68 
were pending in the patent application. 

Claim 1 is amended to further stress that the method involves a user providing 
input to refine and/or define the communication monitoring. Specifically, the user 
selects a category for testing saved communications and also selects regular 
expressions that may be used as criterion for that selected category, which allows the 
user great control over the monitoring that is performed. Claim 1 is also amended to 
con-ect an antecedent basis issue with "the preselected criterion Dependent claims 2 
and 3 are amended to correct antecedent basis issues after the amendment to claim 
1 , claim 4 is amended to stress the user also is allowed to select weights for regular 
expressions, and claim 8 is amended to correct a prior typographical error. 

Independent claim 34 is amended to call for a threshold value to be selected 
based on user input, which is not shown by the art of record. 

After entry of the Amendment, claims 1-4, 6-10, 12-15, 17-36, 38-59, and 61-68 
remain for consideration by the Examiner. 

Rejections under 35 U.S.C §112 

The Office Action of September 29, 2005 rejected claim 1 as being indefinite 
due to lack of antecedent basis for the limitation "the preselected criterion" in line 8. 
Claim 1 is amended to address this rejection and is now believed definite. 

Rejections under 35 U.S.C S102 

The office Action also rejected claims 34-35, 38-39, 44, 47-50, 52-55, 57, 58, 
and 61-64 were again rejected under 35 U.S.C. §1 02(e) based upon U.S. Pat. No. 
6,266,664 ("Russell-Falla"). This rejection is respectfully traversed. 

In the prior Amendment, Claim 34 was amended to clarify that the 

predetermined expressions are defined by a user (e.g., a network administrator, IT 
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specialist, and the like). Further, in this Amendment, claim 34 is amended such that 
the threshold used to determine whether a monitored network session should be 
stored is also selected based on user input. At least these features of claim 34 are not 
shown or suggested by Russell-Falla. As noted in the prior Amendment, Russell-Falla 
does not suggest any means by which the user can define expressions for use in 
testing as called for in claim 34. Instead, Russell-Falla determines the contents of 
database 30 by a neural network or other automated analysis of large numbers of 
content examples. Applicants have found that the complexity of this analysis can be 
avoided by allowing a user to define predetermined expressions, as called for in claim 
34. Moreover, user-defined criteria enable the user to express control and purpose in 
the defined criteria and so enable improved performance. 

Applicant urges the Examiner to carefully consider Russell-Falla's teaching from 
col. 6, line 49 to col. 8, line 3. In this section, Russell-Falla describes in detail its use 
of a neural-network in which each term in a list is initially assigned a weight "at 
random" and an algorithm is used to "arrive at a set of weightings" based on 
processing of "10,000 web pages." No user input is provided at all during this learning 
process as described in Russell-Falla as "training pages are statistically analyzed." In 
direct contrast to this teaching of automated learning based on processing large 
volumes of web pages, the method of claim 34 calls for testing content of a network 
session using expressions from two or more categories "each containing 
predetermined expressions that are defined by a user." Hence, the "testing" element 
of claim 34 is not shown or suggested by Russell-Falla. 

The Office Action cites col. 4, lines 4-13 but this provides no teaching of a user 
defining the regular expressions but instead is referring to the training of a neural 
network. The Office Action further cites col. 6, lines 49-64 and col, 7, lines 16-29, but 
these are the sections that are also cited by the Applicant as teaching away from a 
user being able to define regular expressions for use in monitoring network sessions 
(e.g., instead Russell-Falla teaches an automated process using thousands of web 
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pages). Applicant also requests that the Examiner study Applicant's specification from 
page 6, line 3 to page 8 t line 13 for a good description of an implementation of 
Applicant's invention because the provided example and description clearly show how 
user input can be used to select regular expressions for categories as opposed to 
Russell-Falla. On page 22, the Examiner asserts that Russell-Falla teaches "manual 
classification of training data" but Applicant could find no teaching of such manual 
classification and requests a more specific cite to allow a proper reply to this 
argument. 

Further, claim 34 calls for maintaining a sum of values associated with said 
predetermined expressions found within at least one category and when the sum 
exceeds a user defined threshold, storing such data. Russell-Falla fails to teach 
storing data when it exceeds a threshold for a particular category. The Office Action 
cites col. 5, lines 47-64, but at this citation, the reference merely states that a threshold 
can be used to decide whether to block a web page or to display it. If blocked, there is 
no teaching that the web page is stored as called for in claim 34. The Office Action 
also cites col. 6, lines 29-34 but at this citation, it is taught that a notification is sent to 
an administrator who may allow the page, i.e., overrule the decision based on the 
threshold, but no teaching of saving the content is provided. For this additional 
reason, claim 34 is not anticipated by the reference. 

Yet further, as discussed in the prior Amendment, the following arguments were 
provided and Applicant believes they have not been adequately addressed by the 
Examiner in the response to arguments: "Claim 34 calls for, among other things, 
removing data content that does not contain language elements. The Office action 
cites a portion of Russell-Falla that relates to scanning an HTML page for regular 
expressions. It appears that the entire HTML page is used as input for analysis, 
including non-language elements. Russell-Falla does not show or suggest any activity 
of removing data content that does not contain language elements." 
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"Further, the Russell-Falla reference does not show or fairly suggest capturing 
data on a network comprising multiple half sessions of TCP/IP network 
communications. An HTML page comprises text data extracted from one or more 
TCP packets that are assembled at the browser according to the HTML rules. HTML 
is a markup language, not a protocol. Accordingly, an HTML page does not, by itself, 
define a "session" or "half session". An HTML page, like any computer file, may be 
delivered over a network communication protocol, however, the HTML page is itself 
entirely independent of any particular network communication protocol. Hence, an 
HTML page is by and intent design entirely unaware of any concept of "session" that 
exists on the network itself and so cannot satisfy the claim limitation "wherein the data 
comprises multiple half sessions appearing in claim 34." 

"The HTML page is distinct from a TCP/IP half session. Significantly, the a 
TCP/IP (or other network level) communication typically includes a wide variety of non- 
HTML information. This data may include header information, cookies, parameter 
information, and the like. In some cases the network communication may include 
malicious (or benevolent) code or hidden data that "piggy backs" on the network 
communication packets used to deliver an HTML page. This is equally true of other 
applications such as email, instant messaging, and the like. This piggy backed data is 
not a part of the HTML page in Russell-Falla, but it is a part of the captured half 
session in claim 34. Hence, this data will escape analysis in Russell-Falla, but will be 
subject to monitoring by the invention of claim 34." 

Claims 35, 37-39, 44, 47-50, 52-54, which depend on claim 34, are allowable 
for at least the same reasons as claim 34 set out above. 

Independent claim 55 calls for, among other things, "defining categories with 
weighted predetermined expressions" (emphasis added) and "maintaining a sum of 
values associated with said predetermined expressions found within each category." 
These features of claim 55 are not shown or suggested in the relied on reference. As 
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noted hereinbefore and admitted in the Office action, Russell-Falla does not teach 
plural categories. Applicant maintains the position that Russell-Falla teaches away 
from using multiple categories. Moreover, if one were to modify Russell-Falla as 
suggested in the Office action, one might, by happenstance or invention, come up with 
the solution called for in claim 55. However, that solution is not taught or suggested by 
the reference itself. Further, claim 55 calls for storing the remaining data if the sum of 
values associated with said predetermined expressions present within a category 
exceeds a threshold value. For at least these reasons and as discussed with 
reference to daim 34, claim 55, and claims 57, 58, and 60-64, which depend from 
claim 55, are allowable over Russell-Falla. 

Further, claim 55 requires that the predetermined expressions for "categories 7 ' 
are "defined by a user." As discussed with reference to claim 34, Russell-Falla fails to 
show that a user can define expressions - but instead lists of words or expressions on 
a page are randomly weighted and learning is performed to establish without user 
input a set of learned weights for expressions on a web page that provide a likelihood 
that the page contains a certain content. There is no teaching in Russell-Falla that a 
user can define expressions nor that such user-defined expressions may be weighted 
and assigned to categories. Because each and every element of claim 55 is not 
shown by Russell-Falla, this reference does not support an anticipation rejection of 
claim 55, and Applicant respectfully requests that the rejection be withdrawn. 

Dependent claim 56 further calls for the data to be stored (which Russell-Falla 
fails to show at all) "only if the sum of predetermined expressions exceeds the 
threshold value in a plurality of categories." The Office Action admits that Russell- 
Falla fails to show a concurrent use of categories but maintains the rejection based on 
102 anticipation. Applicant believes that at best this should be an obviousness 
rejection, but more likely, Russell-Falla does not suggest teach comparing a sum to 
determine if it "exceeds the threshold in a plurality of categories." The Examiner's 
arguments indicate that at best Russell-Falla would teach using differing categories 
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but would not teach comparing a sum to multiple categories. 

Rejections under 35 LLS.C 51 03 

Additionally, claims 1-4, 6 r 7, 11-13, 15-21, 23, 27-29, 32 T 33, and 65-67 were 
rejected under 35 U.S.C. §1 03(a) based upon Russell-Falla in view of U.S. Pat. No, 
6,453,345 ("Trcka"). This rejection is respectfully traversed based on the following 
remarks. 

Claim 1 includes limitations similar to that found in claim 34 and is, hence, 
believed allowable over Russell-Falla for the reasons for allowing claim 34 over this 
reference. Specifically, claim 1 calls for storing of the communications when a 
preselected criterion is determined and calls for the user to define the criterion, and as 
discussed with reference to claim 34, Russell-Falla fails to teach either of these 
features of the claimed invention. Further, claim 1 calls for "receiving input from a user 
selecting a subject matter category for use in monitoring network communications" and 
this added limitation is not shown or suggested by Russell-Falla. Further, claims 1 
calls for the criterion to be associated with the selected subject matter category and 
regular expressions to be associated with each category - hence, the user is able to 
select a category and define criterion including regular expressions. These features 
are not shown or suggested by Russell-Falla which, in contrast, teaches using a neural 
network to learn from inspecting thousands of web pages. 

Further, as noted in the last Amendment, claim 1 calls for monitoring network 
communications wherein each network communication comprises multiple half 
sessions, then storing at least some of the communications on disk. An HTML page in 
Russell-Falla is by design distinct and independent of a session at the network 
communication level. Analyzing an HTML page is not fairly construed as monitoring 
TCP/IP network communications. 

Trcka does not overcome the deficiencies of Russell-Falla. Trcka does not 
teach a user selecting a category, defining criterion for inspecting network 
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communications, and does not show that the categories may have regular 
expressions. Trcka does not teach any specific type of analysis that would be 
performed on the raw data packets. Hence, Trcka does not teach the step of testing 
the stored communication for the presence of at least one user-defined criterion. 
Further, Trcka does not show monitoring TCP/IP network communications. Trcka 
stores raw data packets at a network communication at a data link or lower level (e.g., 
Ethernet packets or lower). This is data below the transport level, and below the 
TCP/IP level called for in claim 1. Further, claim 1 calls for storing the communication 
in a conditional manner, w if the presence of at least one preselected criterion is 
determined." Trcka teaches that all raw data packets are stored, not a process of 
storing some and deleting some as called for in claim 1. As discussed in reference to 
daim 34, Russell-Falla does not explicitly teach storing any of the communication. 
Accordingly, the combination of Russell-Falla and Trcka does not suggest the 
invention of claim 1 . 

Moreover, there is no teaching in the references as to how such a combination 
would be achieved. The references appear to teach against the combination 
suggested in the office action. Russell-Falla deals with analyzing a web page before it 
is displayed whereas Trcka specifically captures data passively without interrupting 
delivery. Russell-Falla must analyze HTML pages, not network packets, whereas 
Trcka must capture network packets at a very low level. The two references, as taught 
in the references themselves, describe incompatible systems. Only Applicant has 
recognized and invented a way for performing text analysis akin to what Russell-Falla 
is doing on HTML pages in an offline manner within a network connection, akin to what 
Trcka is doing at a data link layer. 

Claims 6, 7, 11-13, 15-21, 23, 27-29, 32 and 33, which depend from claim 1, 
are allowable for at least the same reasons as claim 1 from which they depend as well 
as the individual limitations appearing in those claims. 
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Also, in the Office Action, Claims 30 and 31 were rejected under 35 U.S.C. 
§1 03(a) as being unpatentable over Russell-Falla in view of Trcka. This rejection is 
traversed based on the following remarks. Claims 30 and 31, which depend from 
claim 1, are allowable over the combination of Russell-Falla and Trcka for at least the 
same reasons stated above for claim 1 . 

Additionally, Claims 36, 51 and 59 were rejected under 35 U.S.C. §103(a) 
based upon Russell-Falla. This rejection is respectfully traversed. Claims 36, 51 and 
59 are allowable over Russell-Falla for at least the reasons stated above with respect 
to claims 34 and 55. 

Further still, the Office Action rejected claims 8-10, 14, 22 and 24-26 under 35 
U.S.C. §1 03(a) based upon Russell-Falla in view Trcka and in further view of U.S. Pat. 
No. 6,366,910 ("Rajaraman"). This rejection is respectfully traversed. 

Rajaraman does not supply the deficiencies of Russell-Falla noted above. With 
respect to claim 1 specifically, the Rajaraman reference does not show or suggest 
monitoring TCP/IP layer communications, storing half sessions to disk or the use of 
plural categories as noted above. Rajaraman involves searching hierarchical data that 
has already been categorized- Claims 8-10, 14, 22 and 24-26, on the other hand, 
involve hierarchical weighted scoring of data for the purpose of subsequent 
categorizing. For at least these reasons it is respectfully requested that the rejection 
of claims 8-10, 14, 22 and 24-26 be withdrawn. 

Additionally, Claims 40-43, 45, 46 and 56 were rejected under 35 U.S.C. 
§1 03(a) based upon Russell-Falla in view of Rajaraman. This rejection is respectfully 
traversed. 

Rajaraman does not supply the deficiencies of Russell-Falla noted above with 
respect to claim 34 and claim 55 from which these claims depend. It is respectfully 
requested that the rejection be withdrawn. Further, claim 40 calls for "prioritizing the 
order in which regular expressions with a subject matter category are tested." 
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Rajaraman is cited at col. 9, lines 19-28 for providing this teaching, but at this citation, 
a search engine is said to prioritize scores of results from a search. There is no 
teaching of prioritizing an order that regular expressions are used to test network 
communications (let alone within a subject matter category). Claim 41 calls for 
"negative value regular expressions to be tested first." Again, Rajaraman is cited at 
col. 9, lines 19-28, but there is no discussion whatsoever of doing a search with 
negative valued expressions nor that such expressions should be used first in a 
search (let alone of a processing of a network communication by looking for regular 
expressions that are associated with negative values first). The value of such a 
technique is explained in Applicants specification in the example provided on pages 7 
and 8 (e.g., less false positives are generated by using negative valued regular 
expressions first). Dependent claim 42 provides another specific limitation regarding 
the order of use of regular expressions based on their associated value, and 
Rajaraman simply provides no teaching of this portion of Applicant's claimed invention. 
For these additional reasons, claims 40-42 are not shown or suggested by the 
combined teaching of these two references. 

Conclusion 

In view of all of the above, it is requested that a timely Notice of Allowance be 
issued in this case. No fee is believed due with this response, but any fee deficiency 
associated with this submittal may be charged to Deposit Account No. 50-1 123. 



December 28. 2005 




Kent Lembke, Reg. No. 44,866 

Hogan & Hartson llp 

One Tabor Center 

1200 17th Street, Suite 1500 

Denver, Colorado 80202 

(720) 406-5378 Tel 
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